server

type App struct {

	// Approval is the optional approval-gate backend. nil disables gating
	// (gates recorded AWAITING are never satisfied → action_required). Set after
	// construction (e.g. by the serve command), so New's signature is unchanged.
	Approval approval.Backend
	// Objects is the optional object store for completed-log offload. nil keeps
	// logs in the local buffer only. Set after construction, like Approval.
	Objects ObjectStore
	// PushVerifier verifies a Pub/Sub push OIDC bearer token, returning the
	// token's email claim. Set externally (like Approval/Objects); nil disables
	// the /pubsub/push endpoint (it returns 404).
	PushVerifier func(ctx context.Context, bearer string) (email string, err error)
	// APIVerifier verifies a Google-signed OIDC bearer token on /api/* routes,
	// returning the token's email claim (audience checking included). Set
	// externally, like PushVerifier; nil disables the OIDC path — only the
	// legacy shared-secret HS256 JWT is accepted then.
	APIVerifier func(ctx context.Context, bearer string) (email string, err error)
	// contains filtered or unexported fields
}

type CheckRunUpdate struct {
	Title      string // check-run title (e.g. "Terraform plan" / "Terraform apply")
	Summary    string // GFM blast-radius headline + verdict chips + per-stack table (renders at the top)
	Text       string // the rendered plan report (renders below the summary)
	DetailsURL string // the live page for the full view
	Conclusion string // "" while running; otherwise success|failure|action_required|neutral
}

type Config struct {
	// WebhookSecret is the bearer token required on /api/* mutations. Empty
	// disables auth (local/dev only).
	WebhookSecret string
	// PublicBaseURL is the public origin used for check-run Details links. Empty
	// derives it from the inbound request (e.g. behind a TLS-terminating proxy).
	PublicBaseURL string
	// LogsDir is where per-stack log buffers are written. Empty disables log
	// ingestion (the endpoints become no-ops).
	LogsDir string
	// GroupDepth controls the live DAG's grouping: stacks fold into groups by
	// their first GroupDepth path segments. 0 = unset → handlers default to 2.
	GroupDepth int
	// GroupPattern is a regexp whose first capture group is the group key;
	// overrides GroupDepth. Empty → fall back to GroupDepth grouping.
	GroupPattern string
	// PushServiceAccount is the allowed verified OIDC email for /pubsub/push.
	// Empty accepts any verified token.
	PushServiceAccount string
	// APIPrincipals maps a verified OIDC caller email (lowercase) to the API
	// scopes it holds (see the scope* constants). Only consulted when
	// App.APIVerifier is set.
	APIPrincipals map[string][]string
	// GitHubWebhookSecret is the HMAC-SHA256 secret GitHub sends on every webhook
	// delivery (X-Hub-Signature-256). Empty disables the /github/webhook endpoint.
	GitHubWebhookSecret string
	// Progress is the optional per-operation weighted phase set (from the policy
	// file's progress{} block) driving the full-progress bar. nil → built-in
	// fractions.
	Progress *config.ProgressConfig
}

type GitHub interface {
	// CreateCheckRun opens an in_progress check run with the given name whose
	// Details link is detailsURL; returns its id.
	CreateCheckRun(ctx context.Context, repo, sha, name, detailsURL string) (int64, error)
	// UpdateCheckRun patches an existing check run.
	UpdateCheckRun(ctx context.Context, repo string, checkRunID int64, u CheckRunUpdate) error
	// PostStatus sets a commit status (commit-status fallback).
	PostStatus(ctx context.Context, repo, sha, context_, state, description, targetURL string) error
	// PRHeadSHA returns the current head commit SHA of a pull request, so a
	// verdict is posted on the live head rather than a stale execution SHA.
	PRHeadSHA(ctx context.Context, repo string, pr int) (string, error)
	// PRAbandoned reports whether a pull request is closed WITHOUT having been
	// merged (i.e. abandoned). A merged PR returns false so its post-merge apply
	// keeps its grant. Returns (false, err) when the PR cannot be read.
	PRAbandoned(ctx context.Context, repo string, pr int) (bool, error)
	// MergeGroupPRs returns the PR numbers whose commits compose the merge group
	// at headSHA, via the commit→PRs association API.
	MergeGroupPRs(ctx context.Context, repo, headSHA string) ([]int, error)
	// ReRequestCheckRun re-requests a GitHub check-run.
	ReRequestCheckRun(ctx context.Context, repo string, checkRunID int64) error
}

type MockGitHub struct {
	CreateCheckRunFn    func(ctx context.Context, repo, sha, name, detailsURL string) (int64, error)
	UpdateCheckRunFn    func(ctx context.Context, repo string, checkRunID int64, u CheckRunUpdate) error
	PostStatusFn        func(ctx context.Context, repo, sha, context_, state, description, targetURL string) error
	PRHeadSHAFn         func(ctx context.Context, repo string, pr int) (string, error)
	PRAbandonedFn       func(ctx context.Context, repo string, pr int) (bool, error)
	MergeGroupPRsFn     func(ctx context.Context, repo, headSHA string) ([]int, error)
	ReRequestCheckRunFn func(ctx context.Context, repo string, checkRunID int64) error
	// CreateCheckRunCalls counts CreateCheckRun invocations so tests can assert
	// the check run is created exactly once (idempotency).
	CreateCheckRunCalls int
}

type ObjectStore interface {
	Put(ctx context.Context, key string, r io.Reader) error
	Get(ctx context.Context, key string) (io.ReadCloser, error)
}

type RealClient struct {
	// contains filtered or unexported fields
}

type Shell struct {
	// contains filtered or unexported fields
}